SQ30119
Detected presence of suspicious file structure malformations.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | high | high | None | malware: warning Reason: malformed components found |
About the issue
File formats are either textual or binary structured object streams. Programs that work with them, called parsers, depend on understanding the format structure. Intentional deviations from the expected file format structure can cause parsing issues, and trigger unintended code execution. During the scan, supported file formats have their specification conformance validated. While some deviations are allowed due to how widespread they are, most are subject to advanced heuristics that can detect attempts to cause format parsing issues.
How to resolve the issue
- When such detections occur, you should first review them for accuracy and assign vulnerability labels upon confirmation.
- If the software intent does not relate to file format validation, investigate the build and release environment for software supply chain compromise.
- Proceed with increased caution when using this software package.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- File format (External resource - Wikipedia)
- Format string attack (External resource - OWASP)